Offgrid Security Research https://www.offgridsec.com/case-studies.html Original vulnerability research and practical application-security guidance from Offgrid Security. en Wed, 29 Jul 2026 00:00:00 GMT OpenAI Open-Sourced Codex Security. Here's How It Compares to Kira. https://www.offgridsec.com/blog-kira-vs-codex-security.html https://www.offgridsec.com/blog-kira-vs-codex-security.html OpenAI released Codex Security, an LLM-only application security agent. We studied the codebase. Here's what we found and why Kira chose a different architecture. Blog Wed, 29 Jul 2026 00:00:00 GMT Kira Found SSRF in Ghost's Webhook Delivery: The Fix Was Already Written https://www.offgridsec.com/blog-ghost-cve-2026-53945.html https://www.offgridsec.com/blog-ghost-cve-2026-53945.html Ghost maintained a hardened SSRF-safe HTTP library and used it everywhere, except webhooks. One line away from safe. A deep dive into CVE-2026-53945. Blog Thu, 25 Jun 2026 00:00:00 GMT Kira Found a CVSS 10.0 Full Compromise in Hoppscotch https://www.offgridsec.com/blog-hoppscotch-cve-2026-50160.html https://www.offgridsec.com/blog-hoppscotch-cve-2026-50160.html One unauthenticated HTTP request grants full server compromise via JWT secret injection. A deep dive into CVE-2026-50160, four chained weaknesses, and what it means for your NestJS stack. Blog Thu, 28 May 2026 00:00:00 GMT Hoppscotch CVE-2026-50160: Unauthenticated Server Takeover https://www.offgridsec.com/case-studies/hoppscotch-cve-2026-50160/ https://www.offgridsec.com/case-studies/hoppscotch-cve-2026-50160/ Technical report on CVE-2026-50160, a CVSS 10.0 mass-assignment vulnerability in Hoppscotch that enabled JWT secret injection and full server compromise. Research report Thu, 28 May 2026 00:00:00 GMT Cognithor API Key Exposure: Unauthenticated Secret Disclosure https://www.offgridsec.com/case-studies/cognithor-api-key-exposure/ https://www.offgridsec.com/case-studies/cognithor-api-key-exposure/ Technical report on an unauthenticated Cognithor endpoint that exposed configured provider API keys, plus the verified remediation in v0.78.2. Research report Wed, 08 Apr 2026 00:00:00 GMT Ghost CVE-2026-53945: Webhook SSRF Vulnerability https://www.offgridsec.com/case-studies/ghost-cve-2026-53945/ https://www.offgridsec.com/case-studies/ghost-cve-2026-53945/ Technical report on CVE-2026-53945, an SSRF flaw in Ghost webhook delivery that could reach internal services and cloud metadata endpoints. Research report Fri, 03 Apr 2026 00:00:00 GMT